Informing the IBM Community

How Can You Update Your UAK Key without an HMC?


I was working at a customer last week when I noticed the system attention light was illuminated on their Power 9 Server. Looking at WRKPRB (work with problems) log, the SRC code was A7004761 which is the code for an expired Update Access Key (UAK).

What is a UAK?

If you are wondering what a UAK is, well, put simply, it is IBM’s method of restricting firmware upgrades to those customers who have active IBM Hardware Maintenance (HWMA) agreements.

Since the launch of the Power8 servers every box has a UAK installed that has an expiry date and as long as you have IBM HWMA then you can get a new UAK allowing newer firmware updates to be installed.

What happens if your UAK expires?

The good news is that even if your UAK expires, it does not stop your system from working and it does not limit it’s speed or existing functionality.  Also, it does not stop you installing IBM i PTFs or IBM i upgrades but it does stop you from keeping your system fully up to date which can open you up to security risks and stop you from using new hardware.

Protip Keeping your Power firmware up to date is a key part of keeping your system secure and a requirement for several regulations like GDPR, PCI-DSS, etc.

So, even if you had the correct firmware file to upgrade your system, if the date of the firmware is newer than the date of your UAK, you will be prevented from installing this firmware.

For example, if you purchased a server on  01/01/2019, your server would have come with a 3-year HWMA included in the standard price. So, you would get a UAK with an expiry date of 31/12/2021. This means, that if you did not renew your IBM HWMA and so get a new UAK, you would not be able to install any Power firmware that was created after 31/12/2021.

ProTip This is something you need to bear in mind if you decide to move away from IBM HWMA. 

What difference does an HMC make?

What’s unusual here is this customer doesn’t have an HMC (yet!).  This server has HWMA and so a new UAK with a longer expiry date was available from the IBM ESS website but because this customer doesn’t have an HMC, the process of downloading and applying this new UAK is a manual one.

ProTip Let me repeat that, if you have an HMC then this UAK update is normally automatic, just make sure your HMC has it Service Call Home function enabled.

How do you apply a UAK without an HMC?

Then the question is how do you apply that to the Server?  In the past I would have logged into the Advanced System Management Interface (ASMI) and applied the key via the Capacity on Demand (CoD) screen. This involves configuring an additionalnetwork connection to your Power server and navigating an interface which is not particularly intuitive and, in some places, downright scary!

But wait a minute, there is a better, easier way!

Using IBM i Electronic Service Agent to update your UAK

From a command line type GO SERVICE to access the Electronic Service Agent (ESA) main menu. Page Down and you will see the menu items below.

Option 20. Check and refresh Update Access Key is the option of interest.

ProTip This only works on Servers that are not managed by an HMC. If you do have an HMC and you take option 20 you get a message to say you have to apply the UAK key using the HMC.

Back to the job in hand. When I first ran this option, it failed. A bit of research revealed that the Country code was incorrect, it had been set to EUR. I found this information here

Note that the UK is found against Great Britain, not United Kingdom

Then using the CHGCNTINF command changed the Country or Region parameter to GB. I think that either GBR or GB would work.

Then, taking option 20 again, the command ran successfully and updated the UAK key.

Use The DSPFWMSTS command showed the new expiry date

ProTip If you do have an HMC remember to complete the customer information found within Service Management. If you don’t the HMC cannot automatically update the UAK key.

What if you don’t have an HMC?

If you don’t have an HMC why not obtain a virtual one? If you are running VMware,  16GB memory  4 virtual processors, 2 network interfaces, 500GB disk gets you up and running and it works really well at a fraction of the cost of buying a physical HMC.

How useful was this post?

Click on a star to rate it!

Average rating 5 / 5. Vote count: 2

No votes so far! Be the first to rate this post.


3 responses to “How Can You Update Your UAK Key without an HMC?”

  1. I was not sure from this article but ss this specific to system I or does this auto renew apply to system P also?

  2. I am going through this process now and just option 20 alone doesn’t work. I contacted IBM and they said you need to go into ESS and renew the UAK key there, then use option 20 and it should grab the new key, otherwise it will just use the old key.

  3. chris birk avatar
    chris birk

    the command is dspfmwsts not dspfwmsts

Leave a Reply

Your email address will not be published. Required fields are marked *